Privacy Policy

1. Who We Are

ScoutingSite™ is a trading name of Camp & Event Solutions Ltd, operating under the laws of Scotland. For the purposes of the UK General Data Protection Regulation (UK-GDPR), Camp & Event Solutions Ltd is the Data Controller.

Contact: [email protected] or by raising a support ticket.

2. Data We Collect & Why

We process your personal data under the lawful basis of Contractual Necessity (to provide the service you paid for) and Legal Obligation (for tax records).

3. Group Email & Media Services

When you use our enterprise-grade infrastructure for email or image storage, we utilize specialized global partners:

4. OSM Integration (Online Scout Manager)

If you choose to connect your Online Scout Manager (OSM) account to ScoutingSite, the live offering is waiting list merge only:

• Access: We use OAuth2 to request limited access to your OSM account. We never see or store your OSM password.
• Waiting list merge: When someone submits a join enquiry on your site, we may add them to your chosen OSM waiting list via their API. We do not currently pull programmes, events, or other OSM records onto your website.
• Data Sync (coming soon): We may pull programme dates, event details, and waiting list counts to display on your website.
• Control: You can disconnect this integration at any time from your settings, which immediately revokes our access token.

5. SumUp (Group shop)

If you connect a SumUp merchant account, ScoutingSite can list products from that catalogue on your Group website and start a checkout when a visitor chooses to buy:

• Access: We use OAuth to connect your SumUp account. We store access and refresh tokens, merchant profile details needed to take payment, and a cached copy of your product catalogue.
• Checkout: The visitor is redirected to SumUp’s hosted checkout. SumUp collects card details. We do not see or store full card numbers. The Group is the merchant of record for that sale; ScoutingSite only starts the checkout and returns the visitor to the Group site afterwards.
• Not Stripe: Stripe is used only for ScoutingSite subscription billing on this platform. Group shop payments are processed by SumUp, not Stripe.
• Control: You can disconnect SumUp at any time from Integrations, which removes our stored tokens.

SumUp’s own terms and privacy notice apply on SumUp’s checkout pages. See SumUp’s privacy notice.

6. Google Calendar and Google user data

This section describes how ScoutingSite accesses, uses, stores, shares and deletes Google user data when a Group leader connects Google Calendar. Connecting Google Calendar is optional and is a Premium feature. ScoutingSite does not access anyone’s Google account unless a signed-in Group owner or admin starts the connection from Website Settings → Integrations.

6.1 What we ask Google for

We use Google OAuth 2.0. We never collect or store Google passwords. We request only these scopes:

• https://www.googleapis.com/auth/calendar.readonly — to list calendars the connected account can read, and to read events from the one calendar the leader chooses to display.
• https://www.googleapis.com/auth/userinfo.email — to show which Google account is connected in settings.

We do not request scopes to create, edit, delete or share calendar events, and we do not request Google contacts, Gmail, Drive, or advertising data.

6.2 Google user data we collect

6.3 How we use Google user data

We use Google user data only to provide and improve the Google Calendar Magic Modules that the leader places on their Group website:

• Show public upcoming events and a month calendar to website visitors.
• Let the leader pick, change or disconnect the calendar in Website Settings.
• Refresh event listings when a visitor or the editor loads a page that includes those modules.

Event details are fetched from Google when a page needs them. We do not keep a long-term archive of calendar events. We do not send Google Calendar data to ScoutingSite AI (Google Gemini or Anthropic Claude), and we do not use it to train AI models.

6.4 How we store Google user data

OAuth tokens, the Google email, the calendar list cache and the selected calendar id are stored in our application database on OVHcloud servers in the United Kingdom. Tokens are transmitted to Google over HTTPS. Access to the dashboard and settings is limited to signed-in Group owners, admins, and ScoutingSite staff who have been given the Group’s support code.

6.5 Sharing and public display

• Website visitors see only public event titles, dates, times and locations that the leader has chosen to publish by connecting that calendar and placing a Magic Module on a public page.
• We do not sell Google user data. We do not share it with advertising platforms, data brokers or information resellers. We do not use it for ads, retargeting, personalised advertising, or to assess creditworthiness.
• We share Google user data with subprocessors only as needed to run the service: OVHcloud (UK hosting) and Google LLC (the Calendar API and, if a visitor clicks through to Google’s own calendar page, Google’s own services). See Google’s Privacy Policy.
• We do not embed a Google Calendar iframe. Events are rendered as ordinary page content on the Group site, so viewing them does not set Google Analytics cookies in the visitor’s browser.

Leaders must not put private personal information (for example children’s names, medical details, or home addresses) in calendar entries that will be shown on the public website.

6.6 Human access

ScoutingSite staff do not routinely read Google Calendar contents. A person may access Google user data only with the user’s permission for support, for security investigations (for example abuse or a bug), to comply with the law, or in aggregated anonymised form for internal operations.

6.7 Retention and how to delete Google user data

• Disconnect in ScoutingSite: Website Settings → Integrations → Google Calendar → Disconnect. This deletes the stored tokens, Google email, calendar list cache and selected calendar from our database. Magic Modules then stop showing events.
• Revoke in Google: You can also remove ScoutingSite from your Google Account at myaccount.google.com/permissions. After that, our tokens will stop working.
• Account closure: If the ScoutingSite account is closed, website data including the Google Calendar connection is purged 30 days later, as in section 11.

6.8 Limited Use disclosure

ScoutingSite's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google Gemini, used for ScoutingSite AI page and blog generation, is a separate service. Connecting Google Calendar does not send your calendar events to Gemini. Google Analytics on scoutingsite.org.uk (section 10) is also separate and is not placed on Group websites.

7. ScoutingSite AI

Our platform includes Artificial Intelligence features (ScoutingSite AI) powered by Google Gemini & Anthropic's Claude:

• Data Processing: When you enter a prompt to generate a page or blog post, that text is sent to Google Gemini and Claude to process your request.
• Privacy: We do not send your personal account details (like your password or billing info) to the AI provider. Only the specific content prompt you provide is shared.
• Training: Under our enterprise agreement, the data sent via ScoutingSite AI is not used by Google to train their global AI models.
• Accuracy: AI is a tool, not a human. You are responsible for reviewing all AI-generated content for accuracy and Scout brand compliance before publishing.

8. Infrastructure & Security

Our core member database and application logic live on OVHcloud. This data is replicated across high-security data centres in the United Kingdom to ensure business continuity and full UK-GDPR compliance.

9. Third Party Processors

We only share data with trusted partners necessary to provide our services:

• OVHcloud: Core Infrastructure (United Kingdom).
• Google Gemini: AI Content Generation (United States / Global).
• Anthropic's Claude: AI Content Generation (United States / Global).
• Tucows / OpenSRS: Domains and Group Email (Canada).
• Cloudflare: Media hosting, Security, and WAF.
• Stripe: ScoutingSite subscription billing only (not Group shop payments).
• SumUp: Optional Group shop catalogue and hosted checkout.
• Google LLC (Google Calendar API): Optional read-only calendar sync for Premium Group websites.
• Online Scout Manager (OSM): Optional waiting list merge.
• Google Workspace: Internal support email and ticket processing.
• MailerSend: Transactional system alerts.
• Google Analytics (Google LLC): Optional website analytics on the ScoutingSite platform website (scoutingsite.org.uk) only. Not used on Group websites we host.

10. Cookies & Analytics

We use essential cookies so you can sign in, stay secure, and complete payments. These are strictly necessary and do not require consent under the UK Privacy and Electronic Communications Regulations (PECR).

If you choose Accept analytics on this website, we load Google Analytics 4 (measurement ID G-BQP2JJPG9T) to understand how people use the ScoutingSite platform. The lawful basis for this is consent. Google Analytics is not used for advertising on our site, and advertising storage remains switched off.

When analytics is allowed, Google may process usage data (pages viewed, device/browser type, approximate location derived from IP address, and referral source). Google Analytics 4 does not store IP addresses. Google LLC is based in the United States; transfers are made using Google’s UK-approved transfer mechanisms, including the UK Extension to the EU-US Data Privacy Framework where applicable. See Google’s Privacy Policy.

You can withdraw consent at any time via Cookie settings. Withdrawing consent stops further analytics cookies from being used; it does not automatically delete cookies already stored in your browser.

11. Data Retention

If you cancel your subscription:

• Member & Website Data: Purged 30 days after account closure.
• Media Assets: Deleted from our storage buckets 30 days after account closure.
• Invoices: Retained for 7 years for HMRC tax compliance.

12. Your Rights

Under the UK-GDPR, you have the right to access, rectify, or erase your data. You may also withdraw your marketing consent at any time via your profile settings, and withdraw cookie/analytics consent via our cookie banner or Cookie Policy.